Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I assume there is an easy solution to this, but I prefer to ask before mucking up our intranet server. During a support session, my co-worker and I realized we could login in with our Kerberos credentials over SSH, but not the console (in this case the VI Client for ESXi, but it does not really matter). So, do I just modify the login PAM config?

Current state:

# PAM configuration for the "sshd" service

# auth
#auth           sufficient             no_warn no_fake_prompts
#auth           requisite       no_warn allow_local
#auth           sufficient              no_warn try_first_pass
auth            sufficient             try_first_pass
auth            required             try_first_pass

# account
#account        required
#account        required
account         sufficient             try_first_pass
account         required

# password
#password       sufficient             no_warn try_first_pass
#password       required             no_warn try_first_pass
password        required

# session
#session        optional
#session        required
session         required           

# PAM configuration for the "login" service

# auth
auth            sufficient             no_warn
auth            include         system

# account
account         requisite
account         required
account         include         system

# session
session         include         system

# password
password        include         system

Any hints or tips welcome.

share|improve this question

Your instinct is correct - the solution is "Make your login service's PAM configuration look like your SSH service's PAM configuration"

Not exactly alike, mind you -- make sure you can still get in with non-kerberos logins as root, for example, in case you need to jump on the console in an emergency. PAM is great for that kind of fallback configuration.

For more details/help see the man pages for the PAM modules in question, and man pam.conf for details on the PAM configuration file format.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.